Privacy Policy

1. General

Data protection and data security when using our website and services are very important to us.

If you would like an introduction to the topic of data protection and the EU General Data Protection Regulation (GDPR), you can find general information on the website of the European Data Protection Board at https://www.edpb.europa.eu or on the website of the data protection supervisory authority in your country.

Below we explain how we collect your personal data when you visit our website or use our services, and what we use it for. Changes in the law or in our internal processes may require us to update this privacy policy, so please read it regularly. This privacy policy applies to the Lastingweb website at https://lastingweb.com ("Website") and to the customer workspace at https://app.lastingweb.com ("Workspace").

2. Information on the controller

2.1 The controller responsible for processing your personal data is GPT LLM ORAGLE Ltd. Liability Co., a Wyoming close limited liability company, 30 N Gould St, Ste N, Sheridan, WY 82801, United States ("we", "us", "Provider"), represented by its Managing Directors Sofia Lopez and Sai Patel. For general questions you can e-mail us at legal@lastingweb.com or call +40 750 458 357. More information is available on our website at https://lastingweb.com.

2.2 We have not appointed a data protection officer. If you have questions about data protection or about exercising your rights under data protection law (see section 10), please contact Sofia Lopez (Managing Director) by e-mail at privacy@lastingweb.com or by post at the address above.

3. General information on data processing

Personal data is any information relating to an identified or identifiable natural person. This includes, for example, your name, address, telephone number, e-mail address, IP address or user behaviour. Information that we cannot link to you, or could link only with disproportionate effort (for example because it has been anonymised), is not personal data.

Processing personal data (for example collecting, retrieving, using, storing or transmitting it) always requires a legal basis or your consent. We delete processed personal data as soon as the purpose of the processing has been achieved and no statutory retention obligation applies any longer.

Where we process your personal data to provide certain services, we explain below the specific processes, the scope and purpose of the processing, its legal basis and how long we keep the data.

Our services are offered only to businesses (law firms and other legal professionals acting in their professional capacity). The personal data we process about our customers is therefore mainly the data of the people who represent, work for or contact those businesses.

You are not required by law to provide personal data to us. However, the data marked as mandatory in the Workspace and in the order process is needed to conclude and perform the contract. Without it we cannot register an account or provide our services.

4. Activities in which we process your personal data

Below is a detailed description of each processing operation involving your personal data that may become relevant when you use our Website, our Workspace and our services.

4.1 Provision and use of the Website and Workspace

a. Type and scope of data processing

To provide our Website and Workspace, we process the personal data that your browser automatically sends to our servers. When you use our Website or Workspace, we collect the following data. It is technically necessary for us to display the pages to you and to keep them stable and secure:

• IP addresses
• Access time
• Information on browser, operating system and language settings
• The page or file requested
• Access status (successful or error code) for each page view

To detect and defend against attacks on our Website and technical infrastructure (for example hacking or denial-of-service attacks), we process personal data including:

• Identification data
• Connection data
• Location data (including IP addresses)

For this purpose we use the DNS, content delivery network (CDN) and proxy services of Cloudflare, Inc. (USA). We have concluded a data processing agreement with Cloudflare in accordance with Art. 28 GDPR to ensure the security of your personal data. Personal data may be processed in Cloudflare's server log files. More information on data protection at Cloudflare is available at https://www.cloudflare.com/privacypolicy/.

b. Legal basis

The legal basis for this processing is Art. 6(1)(f) GDPR. The processing is technically necessary to make our Website and Workspace usable and to prevent and detect attacks on them. It therefore serves our legitimate interest.

c. Storage period

We delete this data as soon as it is no longer needed to display the Website or Workspace. Server log files are kept for no longer than 30 days and then deleted or anonymised, unless a specific security incident requires us to keep individual entries longer. Cloudflare processes its own logs under its own terms. Collecting this data and storing it in log files is necessary to operate the Website and Workspace securely. You may object to this processing under Art. 21 GDPR (see section 10.2.5). However, we will usually be able to show compelling legitimate grounds for continuing it, because the Website and Workspace cannot be operated securely without it. In individual cases we may keep the data longer if the law requires it.

4.2 Registration in the Workspace and e-mail sign-in

a. Type and scope of data processing

You can register in our Workspace by providing personal data. Registration lets you use the functions that require an account, such as the website editor, domain and e-mail management, and the billing area. We do not use passwords. You sign in with a one-time link or code that we send to your e-mail address. To register you, verify the identity of the person making the request and sign you in, we process the following personal data:

• IP addresses
• First name and surname
• E-mail address
• Business address and country
• Name of the law firm or business and, if applicable, its tax identification number or comparable business identification information
• Sign-in events (time, IP address, browser information) and one-time sign-in tokens

b. Legal basis

Processing this personal data is necessary to perform a contract between you and us, or to take pre-contractual measures, under Art. 6(1)(b) GDPR. For people who are not themselves a party to the contract but represent their firm or business, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is in setting up and securely operating the customer account. Processing sign-in events also serves our legitimate interest in account security (Art. 6(1)(f) GDPR).

c. Storage period

One-time sign-in links and codes expire after a short time and are then invalidated. We delete account data as soon as it is no longer needed to perform the contract. After that, we restrict processing of the data until any statutory retention periods have expired. During that time the data is no longer used to identify you or to give access to functions that require an account.

d. Cancellation of the registration / deletion of the user account

As a registered user you can cancel your registration at any time. You can change the data we store about you at any time in your Workspace account settings.

However, we cannot delete data early if it is still needed to perform or terminate a contract.

People who represent their firm or business, and whose data we therefore process on the basis of Art. 6(1)(f) GDPR, have the right to object to that processing under Art. 21 GDPR, as described in section 10.

4.3 Domain registration

a. Type and scope of data processing

You can register, transfer or renew a domain through our Workspace. For this purpose, the following personal data provided by you is processed and passed to the ICANN-accredited registrar or registrar reseller named at the time of the order, to the accredited registrar and to the competent domain registry:

• First name and surname of the domain holder and of the administrative and technical contacts
• Name of the firm or business
• Postal address
• E-mail address and phone number

Depending on the domain extension and the registry's policies, some of this data may be published in public registration directories (WHOIS/RDAP) or disclosed to third parties who have a legitimate interest. The registrar and the registry process this data under their own responsibility and their own privacy policies.

b. Legal basis

Processing this personal data is necessary to perform a contract between you and us, or to take pre-contractual measures, under Art. 6(1)(b) GDPR. For people who are not themselves a party to the contract but represent their firm or business, or who are named as contacts for the domain, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is in registering and administering the domain as ordered.

c. Storage period

We store the personal data until the purpose for which it was collected has been achieved or no longer applies, and then delete it. In individual cases we may keep it longer if the law requires it. The registrar and registry retain registration data under their own policies.

4.4 Order processing

a. Type and scope of data processing

To process customer orders for our services and deliver those services, we process the following personal data provided when you register in the Workspace or place an order:

• IP addresses
• First name and surname
• Business address and country
• E-mail address
• Name of the law firm or business and, if applicable, its tax identification number or comparable business identification information
• The plan, services and options ordered

b. Legal basis

Processing this personal data is necessary to perform a contract between you and us, or to take pre-contractual measures, under Art. 6(1)(b) GDPR. For people who are not themselves a party to the contract but represent their firm or business, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is in processing the orders of our business customers.

c. Storage period

We delete this data as soon as it is no longer needed to perform the contract, in particular once the customer has terminated all of its contracts. After that, we restrict processing until any statutory retention periods have expired, and the data is no longer used for other purposes.

4.5 Payment processing

a. Type and scope of data processing

To process payments for our services, we process the personal data provided when you register in the Workspace or place an order:

• IP addresses
• First name and surname
• Billing address and country
• E-mail address
• Name of the law firm or business and, if applicable, its tax identification number or comparable business identification information
• Payment and transaction data
• The services ordered

Depending on the payment method you choose, this data is passed to one of the following payment service providers:

• Card payments: Stripe (Stripe, Inc., USA, and its affiliates). You enter your card details directly into Stripe's payment form. We do not receive or store your full card number. More information is available at https://stripe.com/privacy.
• Invoice / bank transfer: Mercury Technologies, Inc. (USA) and its partner banks, through which we issue invoices and receive bank transfers.

The following data is passed to the payment service providers and credit institutions involved in processing the payment:

• Name of the invoice recipient
• Billing address
• Invoice or order number
• Card details, if applicable (entered directly with Stripe)
• Name and account details of the paying account, if applicable (bank transfer)
• Invoice amount
• Currency
• Transaction number

b. Legal basis

Where we process your personal data to perform a contract concluded with us, in particular to process payments, the legal basis is Art. 6(1)(b) GDPR. This also applies to processing needed to take pre-contractual measures. For people who are not themselves a party to the contract but pay or act on behalf of their firm or business, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is in receiving payment for our services. Where your card issuer or a payment service provider must apply strong customer authentication under Directive (EU) 2015/2366 (PSD2), that provider carries out the authentication under its own legal obligations. Where we keep payment records to comply with US tax and accounting rules, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is in complying with the laws that apply to us.

c. Storage period

We store the account and payment information for as long as the customer relationship is active. After that, we keep it only to comply with statutory retention obligations (see section 9) and then delete it.

4.6 Fraud and abuse prevention

a. Type and scope of data processing

To protect against payment fraud, automated abuse (bots, spam) and misuse of our services for illegal purposes (for example hosting illegal content or sending spam), we process the following personal data:

• IP addresses
• First name and surname
• Address and country
• E-mail address
• Name of the law firm or business and, if applicable, its tax identification number or comparable business identification information
• Payment, device and browser information processed during checkout and form submissions

We use Stripe's fraud screening for card payments. Stripe analyses payment, device and network data to assess the risk of fraud. Stripe may process some of this data as an independent controller for its own fraud-prevention purposes. In that respect Stripe's privacy policy applies: https://stripe.com/privacy.

To protect our forms (including the Workspace sign-in form and contact forms on customer websites) against bots, we use Cloudflare Turnstile from Cloudflare, Inc. (USA). Turnstile evaluates technical signals from your browser and connection (including your IP address) to tell humans from automated requests. In most cases it does not show an interactive challenge.

b. Legal basis

This processing is necessary to protect our legitimate interest in preventing fraud and abuse (Art. 6(1)(f) GDPR). It serves our legitimate interest in minimising the risk of payment defaults, misuse and fraud, and in protecting our customers and our infrastructure.

c. Storage period

We store the data until you ask us to delete your account. After that, we restrict processing and no longer use the data for fraud prevention, except where it is needed to clarify an existing suspicion of fraud or abuse. Stripe and Cloudflare keep data under their own retention policies.

4.7 Sanctions list screening

a. Type and scope of data processing

To comply with sanctions laws, we compare the customer data you provide during registration and ordering (name, firm or business name, address and country) with sanctions lists. These include the lists of the US Office of Foreign Assets Control (OFAC), such as the Specially Designated Nationals (SDN) list, and the consolidated EU sanctions list. We carry out this screening in-house; we do not use an external screening provider.

b. Legal basis

The processing is necessary for our legitimate interest in complying with the US sanctions laws that apply to us and in respecting EU sanctions (Art. 6(1)(f) GDPR). Where the screening is required by EU or member state law that applies to us, the legal basis is also Art. 6(1)(c) GDPR.

c. Storage period

We store the personal data until the purpose for which it was collected has been achieved or no longer applies, and then delete it. Records of screening results may be kept for as long as sanctions law requires (see section 9).

4.8 Customer and product support

a. Type and scope of data processing

To handle the customer and product support requests we receive by e-mail (for example at support@lastingweb.com) or by phone, we process:

• Surname
• First name
• E-mail address
• Phone number
• Any other personal data you include in your message, and information about the content of your request

b. Legal basis

The processing is necessary to handle your request or concern (Art. 6(1)(b) GDPR). Where the request does not relate to a contract or pre-contractual measures, or where you contact us on behalf of your firm or business, the legal basis is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

c. Storage period

Depending on the content of the request, we use the data only for the specific purpose of the request and stop processing it as soon as the request has been dealt with. We delete the data once all mandatory retention periods have expired.

4.9 Website content and media hosting

a. Type and scope of data processing

We host the presentation websites of our customers and the content they create in the Workspace editor. This includes texts, photos, blog articles, drafts, previews, published releases and the release history. This content may contain personal data, for example the names, photos, professional profiles and contact details of the firm's lawyers and staff. It also includes the personal data of people mentioned in blog articles. Website files, the Workspace database and the content created in it are stored on servers of Contabo GmbH in Germany. Published website releases and media files are also stored in Cloudflare R2 object storage. The storage location of R2 is managed by Cloudflare and may be outside the EU, including the USA (see section 8). Websites are delivered to visitors through Cloudflare's network.

The customer (the law firm) is the controller for the content it publishes on its website. We process this content as a processor on the customer's behalf under Art. 28 GDPR and our data processing agreement with the customer, which is incorporated by reference into every contract (Clause 12 of the Terms and Conditions, together with the list of sub-processors in section 8 of this privacy policy); a countersigned copy, including the EU Standard Contractual Clauses where required, is available on request at privacy@lastingweb.com. The customer's own privacy notice on its website governs how it processes its visitors' data.

b. Legal basis

As a processor, we process this content only on the customer's documented instructions in order to perform our contract with the customer. The customer, as controller, is responsible for having a legal basis for publishing the content. Where we process content for our own purposes, for example to keep operational backups or to deal with abuse reports, the legal basis is our legitimate interest in operating the service securely (Art. 6(1)(f) GDPR).

c. Storage period

We store content for as long as the customer's account exists. We keep earlier releases in the release history so they can be rolled back. After the contract ends, we delete the content within 30 days, unless statutory obligations require us to keep it. Before that, customers can export their content from the Workspace. Operational backups are overwritten in the regular backup cycle within 30 days.

4.10 E-mail hosting

a. Type and scope of data processing

If the customer uses our business e-mail service, we operate its mailboxes, aliases and forwarding rules on our own mail servers, hosted with Contabo GmbH in Germany. For this purpose we process:

• Mailbox names, aliases and forwarding addresses
• Content of e-mails sent and received, including attachments
• Metadata (sender, recipient, time, size, IP addresses of sending and receiving servers) and mail server log data
• Data used for spam and malware filtering

We process e-mail content as a processor on behalf of the customer (Art. 28 GDPR). We do not access e-mail content except where this is needed to provide the service, to fix faults, to prevent abuse or to comply with the law.

b. Legal basis

We process e-mail content and mailbox data on the customer's instructions to perform our contract with the customer. Processing log data and filtering spam and malware serve our legitimate interest in operating the mail service securely and reliably (Art. 6(1)(f) GDPR).

c. Storage period

E-mails are kept until the mailbox user deletes them or the mailbox is closed. Mail server logs are kept for 30 days. After the contract ends, mailboxes are deleted within 30 days.

4.11 AI-assisted drafting

a. Type and scope of data processing

The Workspace offers optional AI-assisted text drafting. This function is used only when a user actively requests it. In that case, we send the instructions the user enters and the website texts the user selects to the API of OpenAI (OpenAI, L.L.C., USA), which generates a text proposal. Proposals are never published automatically. The customer must review and approve each proposal before it is used.

Under OpenAI's API terms, data sent through the API is not used by default to train OpenAI's models. OpenAI may keep API inputs and outputs for up to 30 days to monitor for abuse, and then deletes them. We have concluded OpenAI's data processing addendum, which includes the Standard Contractual Clauses. More information is available at https://openai.com/enterprise-privacy/. Please do not enter confidential client information or special categories of personal data into the AI drafting function.

b. Legal basis

The processing takes place at the customer's request to perform the contract (Art. 6(1)(b) GDPR). For users who act for their firm but are not themselves a party to the contract, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is in providing the function the user requested. Where the text contains personal data of third parties, we process it as a processor on the customer's behalf.

c. Storage period

Unless the customer saves a proposal, we do not store it beyond the editing session. Proposals the customer saves become part of the website content (see section 4.9).

4.12 Contact forms on customer websites

a. Type and scope of data processing

Customer websites may include a contact form that visitors can use to send enquiries to the law firm. When a visitor submits the form, we process the following data, forward the enquiry by e-mail to the address the firm has specified and store it in the firm's Workspace:

• Name
• E-mail address and, if provided, phone number
• Content of the message
• Time of submission, IP address and Cloudflare Turnstile verification result

For these enquiries, the law firm is the controller and we act as its processor under Art. 28 GDPR. Visitors can find information on how the firm processes their enquiry in the firm's privacy notice on its website. Visitors who want to exercise their data protection rights in relation to an enquiry should contact the law firm. Please note that sending an enquiry through a contact form does not by itself create a lawyer–client relationship. Visitors should consider carefully what confidential information they include.

b. Legal basis

The law firm determines the legal basis for processing the enquiry. Typically this is Art. 6(1)(b) or (f) GDPR. We process the data on the firm's documented instructions under our data processing agreement with the firm, which is incorporated by reference into every contract (Clause 12 of the Terms and Conditions, together with the list of sub-processors in section 8 of this privacy policy); a countersigned copy, including the EU Standard Contractual Clauses where required, is available on request at privacy@lastingweb.com.

c. Storage period

Enquiries are stored in the firm's Workspace for the duration of the contract. We delete them within 30 days after the contract ends, or earlier if the firm deletes them. The firm decides how long it keeps the enquiries it receives by e-mail.

4.13 Reports of abuse and illegal content

a. Type and scope of data processing

Anyone can report abuse of our services or illegal content on websites we host by e-mail to abuse@lastingweb.com. To handle such reports, we process the name and e-mail address of the person reporting, the content of the report, and the personal data contained in or affected by the reported content. Where necessary to assess the report, we may inform the customer concerned of the report. We disclose the identity of the person reporting only where this is necessary and permitted by law.

b. Legal basis

The processing serves our legitimate interest in preventing misuse of our services and in responding to reports of illegal content (Art. 6(1)(f) GDPR). Where EU law, in particular Regulation (EU) 2022/2065 (Digital Services Act), requires us to process notices and inform the parties concerned, the legal basis is also Art. 6(1)(c) GDPR.

c. Storage period

We store reports and related correspondence for as long as needed to handle the report and any follow-up, and then for 12 months after the report is closed to document our handling of it, unless a longer period is needed to establish, exercise or defend legal claims.

5. Cookies

a. Type and scope of data processing

Our Website and Workspace use only cookies and similar technologies that are strictly necessary. Cookies are small files that are sent to your browser and stored on your device when you visit our pages. They cannot run programs or carry viruses. We use the following strictly necessary cookies:

We do not use analytics, performance, advertising or marketing cookies, tracking pixels or similar third-party tracking technologies. For this reason we do not show a cookie consent banner.

b. Legal basis

Storing and reading these cookies on your device is exempt from consent because it is strictly necessary to provide the service you have requested (Art. 5(3) of Directive 2002/58/EC (ePrivacy Directive) and the national laws implementing it). Any processing of personal data involved is based on Art. 6(1)(b) GDPR, where it is needed to provide the Workspace, and on Art. 6(1)(f) GDPR, where it serves our legitimate interest in security.

c. Storage period

Each cookie is deleted at the latest when the lifetime shown in the table above expires. The session cookie is also deleted when you sign out; a Workspace session lasts at most 8 hours. Turnstile data is kept only for as long as needed to complete the verification.

d. Configuration of the browser settings

Most browsers accept cookies by default. You can set your browser to accept only certain cookies, or none at all. If you block strictly necessary cookies, you may not be able to sign in to the Workspace or submit forms. You can also delete cookies already stored in your browser, or set your browser to notify you before cookies are stored. Because browsers differ, please see your browser's help menu for the available settings.

6. Security measures to protect the data stored by us

We are committed to protecting your privacy and treating your personal data confidentially. To prevent the loss or misuse of the data we store, we take technical and organisational security measures, which we review regularly and adapt to technological progress. These include encrypted connections, password-free sign-in with one-time links or codes, and restricted access to systems. However, because of the way the internet works, people or institutions outside our area of responsibility may not observe data protection rules or the security measures described above. In particular, data sent unencrypted, including by e-mail, can be read by third parties, and we have no technical control over this. Users are responsible for protecting the data they provide against misuse, for example by encrypting it.

7. Hyperlinks

Our Website contains hyperlinks to websites of other providers. If you follow such a link, you leave our Website and go directly to the other provider's website. You can recognise this, among other things, by the change of URL. We cannot accept any responsibility for how your data is handled on other websites. Please see the respective websites for information on how they handle your personal data.

8. External service providers

We use service providers to deliver our services and to process your data in connection with them. Where these service providers act as our processors, they process the data only on our instructions and must comply with the applicable data protection rules. We have selected all processors carefully. They receive access to your data only to the extent and for the time needed to provide their services. Some recipients, such as domain registrars and registries and, for their own fraud-prevention purposes, Stripe, process data as independent controllers under their own privacy policies (see sections 4.3, 4.5 and 4.6). We also disclose personal data to public authorities, courts or other bodies where we are legally required to do so.

Transfers to the USA. We are a company established in the USA. Personal data you provide to us is therefore received by a controller in the USA. Where we offer our services to people in the EU/EEA or the UK, the GDPR (or UK GDPR) applies to our processing under Art. 3(2) GDPR. Websites, the Workspace database and mailboxes run on servers in Germany (EU). Published website releases and media files are also stored in Cloudflare R2 object storage, whose location is managed by Cloudflare and may be outside the EU, including the USA. Personal data may also be transferred to service providers in countries outside the EU/EEA, in particular the USA, where the GDPR does not apply directly. Since 10 July 2023, transfers to US companies certified under the EU-US Data Privacy Framework (DPF) have been covered by an adequacy decision of the European Commission. Where a recipient is not certified, or no adequacy decision exists for the country concerned, we ensure an appropriate level of data protection by concluding the European Commission's Standard Contractual Clauses and implementing additional measures where necessary. Where our EU-based hosting provider transfers data back to us in the USA, this is covered by the Standard Contractual Clauses (Module 4, processor-to-controller). As we are ourselves subject to the GDPR under Art. 3(2) GDPR, the GDPR continues to apply to our processing of that data. You can request a copy of the applicable safeguards at privacy@lastingweb.com.

9. Storage period

We delete your personal data as soon as the purpose of the processing has been achieved or no longer applies.

To meet our contractual obligations, we may keep data collected from you for as long as the contract exists. After the contract ends, we may keep it for up to seven years to comply with statutory record-keeping and retention obligations, in particular US federal tax and accounting rules, and to deal with any enquiries or claims that may arise.

If, in our reasonable judgement, data is needed to establish or defend against claims, to initiate criminal prosecution, or to bring claims against you, us or third parties, we may keep it for as long as such proceedings could be brought.

For customer service purposes, we may keep the data collected from you for up to three years after the end of the customer relationship, unless you ask us to delete it and no contractual or statutory retention obligation prevents this.

Relevant record-keeping and retention obligations arise, among others, from US federal tax law (Internal Revenue Service record-keeping requirements), from US sanctions regulations, and from the Wyoming law governing limited liability companies.

Where we keep data to comply with statutory obligations under EU or member state law, the legal basis is Art. 6(1)(c) GDPR. Where we keep data to comply with other laws that apply to us, the legal basis is our legitimate interest under Art. 6(1)(f) GDPR.

10. Your rights as a data subject affected by data processing

10.1 You can exercise your data subject rights at any time by e-mail to privacy@lastingweb.com. Please note that we cannot handle telephone enquiries about personal data, because we generally cannot verify the caller's identity with enough certainty. Where we process data as a processor on behalf of a law firm (sections 4.9, 4.10, 4.11 and 4.12), please send your request to the firm. We will support the firm in responding to it.

10.2 You have the following rights regarding your personal data:

10.2.1 Right of access, Art. 15 GDPR. You can ask us at any time for information about the data we hold about you, its origin, the recipients or categories of recipients to whom it is disclosed, and the purpose of storing it.

10.2.2 Right to rectification, Art. 16 GDPR. You can ask us to correct inaccurate data or complete the data we hold about you.

10.2.3 Right to erasure and restriction, Art. 17 and 18 GDPR. You have the right to have the personal data we hold about you restricted or deleted. If statutory retention obligations or other legal reasons prevent deletion, we restrict the data instead of deleting it.

10.2.4 Right to data portability, Art. 20 GDPR. If the legal requirements are met, you can ask us to provide the personal data concerning you in a structured, commonly used and machine-readable format, either to you or, where technically feasible, to another controller you name.

10.2.5 Right to object, Art. 21 GDPR. You have the right to object to processing for certain purposes. Where we process your data on the basis of a balancing of interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. Such grounds exist in particular where they give your interests special weight so that they outweigh ours, for example because we did not know about them and so could not take them into account when balancing interests. You can object by e-mail to privacy@lastingweb.com. We will then tell you about any further ways to object to each specific processing purpose described in section 4.

10.2.6 Right to withdraw consent, Art. 7(3) GDPR. Where we process your personal data on the basis of your consent, you can withdraw that consent at any time and without giving reasons. You can withdraw it for all processing activities or only for individual ones. The withdrawal takes effect immediately for all future processing. Processing carried out before the withdrawal remains lawful. You can withdraw your consent by e-mail to privacy@lastingweb.com.

10.3 You also have the right to lodge a complaint with a data protection supervisory authority if you have questions or complaints about how we process your personal data. In particular, you can contact the supervisory authority in the EU/EEA member state where you live or work, or where the alleged infringement took place. A list of EU/EEA supervisory authorities is available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. If you are in the United Kingdom, you can contact the Information Commissioner's Office (https://ico.org.uk).

11. Automated decision-making / profiling

We do not use automated decision-making within the meaning of Art. 22 GDPR or profiling (automated analysis of your personal circumstances) to make decisions about you. Stripe's automated fraud screening (section 4.6) may decline a card payment that it assesses as high-risk, and Cloudflare Turnstile may block a form submission it identifies as automated. If this happens, you can contact us at support@lastingweb.com to have the matter reviewed by a person, to state your point of view, or to use another payment method. AI-generated text proposals (section 4.11) are only suggestions, and the customer must approve them.

Status: October 2026